---
id: "CVE-2026-119441"
kind: "vulnerability"
aliases: ["CVE-2026-119441"]
title: "Forgejo-style git host: public-only token can delete private org repositories"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["api-tokens", "git-hosting", "other", "self-hosted"]
not_affected_if: ["no-public-organizations"]
published_at: "2026-11-01T10:18:36+00:00"
first_seen_at: "2026-11-01T10:49:33+00:00"
updated_at: "2026-11-01T10:51:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119441", "first_seen_at": "2026-11-01T10:49:33+00:00"}]
---

# Forgejo-style git host: public-only token can delete private org repositories

A DELETE API route that removes all repositories of an organization checked only whether the organization was public, not whether the caller's access token was restricted to public resources. A public-only access token belonging to an owner of a public organization could therefore permanently delete that organization's private repositories.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the route `DELETE /api/v1/orgs/{org}/repos` in the product's version and check whether it is in use
- Check the product's version against the fixed releases listed by the vendor (unknown from the sources)

## Timeline

- 2026-11-01T10:49:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119441

## From the sources

`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently delete the organization's private repositories, which such a token must not reach. Routes that require organization ownership now reject public-only tokens.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_